Skip to main content

CCC.Logging.TH02: Unauthorized Data Transfer Out of a Trusted Boundary

Threat ID:CCC.Logging.TH02
Title:Unauthorized Data Transfer Out of a Trusted Boundary
Description:

Sensitive log data, including PII, financial transaction details, or system vulnerabilities, is exfiltrated directly from the logging service's query or API interfaces by authorized but malicious insiders or compromised accounts exploiting legitimate access.

Related Capabilities

IDTitleDescription
CCC.Core.F06Access ControlThe service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes.
CCC.Core.F14API AccessThe service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE.

External Mappings

Reference IDEntry IDStrengthRemarks
MITRE-ATT&CK
T1048
0
Exfiltration Over Alternative Protocol
MITRE-ATT&CK
T1567
0
Exfiltration Over Web Service
MITRE-ATT&CK
T1020
0
Automated Exfiltration

Controls

IDTitleObjectiveControl FamilyThreat MappingsGuideline MappingsAssessment Requirements
CCC.Logging.C06Detect and Alert on Potential Log ExfiltrationIdentify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data. Logging and Monitoring
1
5
1